https://community.splunk.com/t5/Splunk-Search/Subtotal-percentage-with-stats/m-p/556151#M157918 <P>The reason for list rather than values is to keep the count and process in line because values sorts them. If you can't use list, you should consider creating a concatenated field before using values.</P> Thu, 17 Jun 2021 11:00:44 GMT ITWhisperer 2021-06-17T11:00:44Z https://community.splunk.com/t5/Splunk-Search/Subtotal-percentage-with-stats/m-p/555946#M157862 <P>I'm working with Windows events, and want to make following report/search:<BR /><BR />process1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Total XX XX%<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; command_line1 XX%<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; command_line2 XX%<BR />…</P><P>process4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Total XX XX%<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; command_line1 XX%<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; command_line2 XX%<BR /><BR /></P><P>&nbsp;</P><P>What I come up with:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">`index_windows` EventCode=4688 | fields Process_Command_Line, New_Process_Name | stats count(Process_Command_Line) as totalCount by New_Process_Name, Process_Command_Line | eventstats sum(totalCount) as _total | eventstats sum(totalCount) as _totalPerProcess by New_Process_Name | eval percentageTotal=round((totalCount/_total)*100,2) | eval precentagePerProcess=round((totalCount/_totalPerProcess)*100,2) | sort - totalCount</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>The only thing is that I can't figure out how to merge fields by New_Process_Name</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="dauren_akilbeko_0-1623837792088.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14651i265F46390044CFFB/image-size/medium?v=v2&amp;px=400" role="button" title="dauren_akilbeko_0-1623837792088.png" alt="dauren_akilbeko_0-1623837792088.png" /></span></P><P>&nbsp;</P> Wed, 16 Jun 2021 10:06:57 GMT https://community.splunk.com/t5/Splunk-Search/Subtotal-percentage-with-stats/m-p/555946#M157862 dauren_akilbeko 2021-06-16T10:06:57Z https://community.splunk.com/t5/Splunk-Search/Subtotal-percentage-with-stats/m-p/555960#M157865 <LI-CODE lang="markup">`index_windows` EventCode=4688 | fields Process_Command_Line, New_Process_Name | stats count(Process_Command_Line) as totalCount by New_Process_Name, Process_Command_Line | eventstats sum(totalCount) as _total | eventstats sum(totalCount) as _totalPerProcess by New_Process_Name | eval percentageTotal=round((totalCount/_total)*100,2) | eval precentagePerProcess=round((totalCount/_totalPerProcess)*100,2) | stats list(Process_Command_Line) as Process_Command_line list(percentageTotal) as percentageTotal values(percentagePerProcess) as percentagePerProcess by New_Process_Name | sort - totalCount</LI-CODE> Wed, 16 Jun 2021 12:04:26 GMT https://community.splunk.com/t5/Splunk-Search/Subtotal-percentage-with-stats/m-p/555960#M157865 ITWhisperer 2021-06-16T12:04:26Z https://community.splunk.com/t5/Splunk-Search/Subtotal-percentage-with-stats/m-p/556147#M157916 <P>Thank you, so simple!&nbsp;<span class="lia-unicode-emoji" title=":face_with_rolling_eyes:">🙄</span> Changed list to values though, as it hit the limit.</P> Thu, 17 Jun 2021 09:22:36 GMT https://community.splunk.com/t5/Splunk-Search/Subtotal-percentage-with-stats/m-p/556147#M157916 dauren_akilbeko 2021-06-17T09:22:36Z https://community.splunk.com/t5/Splunk-Search/Subtotal-percentage-with-stats/m-p/556151#M157918 <P>The reason for list rather than values is to keep the count and process in line because values sorts them. If you can't use list, you should consider creating a concatenated field before using values.</P> Thu, 17 Jun 2021 11:00:44 GMT https://community.splunk.com/t5/Splunk-Search/Subtotal-percentage-with-stats/m-p/556151#M157918 ITWhisperer 2021-06-17T11:00:44Z